DIGITAL SANKALP: Security

Showing posts with label Security. Show all posts

security, hackers Listen up: RSA keys snatched by recording CPU sounds with a phone

It sounds too preposterous for even James Bond: by placing a mobile phone next to a PC, researchers can "listen" to the faintest sound a CPU makes as it churns away on RSA-encoded content and extract the keys themselves. Preposterous, except for the fact that Adi Shamir, one of the co-developers of the RSA encryption algorithm, co-wrote the paper that describes how to do it. Daniel Genkin and Eran Tromer were the other two authors. This is all that's necessary to steal RSA keys from a laptop. "The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts," the paper's authors wrote. "We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away." The authors were able to experimentally succeed with their method using either an ungainly, and extremely obvious, parabolic antenna from 4 meters away, or by using a generic mobile phone from just 30 centimeters away.  Naturally, better listening equipment decreased the time to extract the RSA keys. And it gets even worse: merely touching the PC also allowed an attacker to extract the keys by measuring the electric potential of the PC chassis. In this case, users who touched the PC (and surreptitiously measured their electric potential) should be able to extract the keys. And be persuading the victim to plug in either an innocuous-looking VGA or ethernet cable into his laptop, the attacker could measure the shield potential elsewhere and get the keys as well. DANIEL GENKIN, ADI SHAMIR, ERAN TROMER Attacks over longer distances are feasible using a parabolic antenna. Typically, simply having physical access to a unsuspecting PC is enough for some security experts to throw up their hands and concede that the attacker has won. And that's true, in this case, as well. But the paper's authors demonstrated an "attack" running in a lecture hall, and suggested other plausible scenarios: Install an attack app on your phone. Set up a meeting with your victim, and during the meeting, place your phone on the desk next to the the victim's laptop. Break into your victim's phone, install your attack app, and wait until the victim inadvertently places his phone next to the target laptop. Construct a webpage, and use the microphone of the computer running the browser using Flash or another method. When the user permits the microphone access, use it to steal the user's secret key. Put your stash of eavesdropping bugs and laser microphones to a new use. Send your server to a colocation facility, with a good microphone inside the box. Then acoustically extract keys from all nearby servers. Get near a protected machine, place a microphone next to its ventilation holes, and extract the secrets The techniques the authors describe can be countered by sound dampening, but the white noise of a PC's fan can be pretty easily filtered out. The researchers said that they supplied their attack vector to GnuPG developers before publication, let them develop revised code, and yet it was still vulnerable. The answer may lie in using software to try and obfuscate the audible sound emanations, they said. In any case, the paper that Genkin, Shamir, and Tromer authored is seriously scary stuff, especially for business or government travelers carrying sensitive information outside the country as well as into and through strange hotels and conference rooms.

security, hackers Listen up: RSA keys snatched by recording CPU sounds with a phone

It sounds too preposterous for even James Bond: by placing a mobile phone next to a PC, researchers can "listen" to the faintest s...

12:12 am

security, hackers Listen up: RSA keys snatched by recording CPU sounds with a phone

security, hackers Listen up: RSA keys snatched by recording CPU sounds with a phone

It sounds too preposterous for even James Bond: by placing a mobile phone next to a PC, researchers can "listen" to the faintest s...

12:12 am

Force YouTube to buffer your entire video

<div class="imageContainer580xX" style="width:320px;height:auto;clear:both;margin:auto;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;line-height:19px"><img class="largeImage imgId100052479 " itemprop="image" src="http://zapt0.staticworld.net/images/article/2013/09/youtube-center-100052479-large.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: 320px; max-width: 100%;"></div> <div class="department" style="margin:0px 0px 10px;overflow:hidden"><a class="topCatLink" href="http://www.pcworld.com/category/browsers" style="color:rgb(172,31,43);float:left;font-family:facitweb,sans-serif;font-size:16px;font-weight:700;text-transform:uppercase;margin-right:5px">Back in the good old days, when you started watching a YouTube video, the entire thing would download (or "buffer") in the background, thus ensuring a relatively smooth playback experience. </a></div>If you had a slow connection, you could simply pause the video until you saw the "buffer bar" complete its journey from left to right. But thanks to YouTube's switch to a new protocol (Dynamic Adaptive Streaming over HTTP, or DASH, if you're interested), that trick no longer works. Now, when you play a video, YouTube buffers only a small amount. And that can lead to stuttering, frequently interrupted playback. Thanks to a browser add-on called<a href="https://github.com/YePpHa/YouTubeCenter/wiki" style="color:rgb(37,167,215)">YouTube Center</a>, it's now possible to disable DASH, thus forcing YouTube to buffer your entire video. That's the good news. The bad news is that it can be a little tricky to install depending on which browser you use. The Firefox crowd has it easy: Just grab the extension via <a href="https://addons.mozilla.org/en-us/firefox/addon/youtube-center/" style="color:rgb(37,167,215)">Mozilla's Add-Ons library</a> (assuming you're okay with installing a "non-reviewed" extension). As a Chrome user, I had to jump through a few hoops. Here's the process:1. <a href="https://dl.dropboxusercontent.com/u/13162258/YouTube%20Center/YouTubeCenter.crx" style="color:rgb(37,167,215)">Download YouTube Center</a> in the form of a .CRX file, which was designed for the Opera browser but will also work in Chrome. Ignore any error message you see regarding compatibility. 2. In Chrome, click the Settings button, then click Tools, Extensions to open the Extensions tab. 3. Drag the downloaded .CRX file to that Extensions tab, then agree to the installation request.4. Now open YouTube in a new tab. You should immediately see the YouTube Center settings window. (If not, click the little gear icon in the upper-right corner of the YouTube screen.) 5. Click Player, then clear the checkbox next to DASH. Close the YouTube Center window and you're done! Now, when you start a video, you'll see the buffer bar run all the way to the right, indicating that the full video is queued for playback, not just a few seconds' worth. By the way, the developer offers a tutorial for <a href="https://github.com/YePpHa/YouTubeCenter/wiki/How-to-use-YouTube-Center-with-Internet-Explorer" style="color:rgb(37,167,215)">installing YouTube Center in Internet Explorer</a>, which definitely isn't easy. Sorry, novices, you may want to sit this one out. As you've no doubt noticed, YouTube Center offers a wealth of other options besides DASH disabling. Feel free to poke around and share any cool tricks you find!

Force YouTube to buffer your entire video

Back in the good old days, when you started watching a YouTube video, the entire thing would download (or "buffer") in the backg...

8:48 am

Force YouTube to buffer your entire video

Force YouTube to buffer your entire video

Back in the good old days, when you started watching a YouTube video, the entire thing would download (or "buffer") in the backg...

8:48 am

Security to go: Three tips to keep your mobile data safe

Keeping your mobile gear secure while you're zipping across the grid is tricky business. Laptops and tablets—veritable gold mines of personal information—are popular targets for thieves. Law enforcement officials, meanwhile, could confiscate your smartphone and then examine the data—merely as a result of a<a href="http://www.aclumich.org/issues/privacy-and-technology/2011-04/1542" style="color:rgb(37,167,215)" target="_blank"> routine traffic stop</a>. If you're packing an Android device, it gets even trickier, because with such a device, you stand a better chance of falling prey to the booming mobile malware market. Independent malware testing lab <a href="http://www.av-test.org/en/home/" style="color:rgb(37,167,215)" target="_blank">AV-Test</a> had less than 10,000 Android malware samples in its database by late 2011. Now, two years later, that number has blossomed to around 1.3 million. Data security is never easy, and security with mobile devices—smartphones, tablets, and, of course, laptops—is no exception. But you cantake a few steps to meaningfully improve your mobile security. Join me as we walk through three of the best strategies. (Note: Click on the smaller images below, to enlarge them.) <h2 dir="ltr" style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">Encrypt everything</h2> One of the easiest things you can do to protect an Android or iOS device is to take advantage of built-in hardware encryption. This feature will turn the data on your phone into nearly unreadable junk—unless it's properly unlocked with your password. Let's start with the easy one: iOS. Owners of iPhones or iPads can rest easy knowing the data is <a href="http://www.pcworld.com/article/2050765/the-7-best-crime-fighting-features-of-ios-7.html" style="color:rgb(37,167,215)" target="_blank">already encrypted</a>, provided you create a passcode from the lock screen. Here's how to password-protect your iPhone: In Settings, tap on General > Passcode Lock.<a href="http://images.techhive.com/images/article/2013/10/passcode-100057122-orig.jpg" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="210" src="http://images.techhive.com/images/article/2013/10/passcode-100057122-small.jpg" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="140"></a> You'll need to choose whether to use a four-digit numeric PIN or something more complex. Longer is always better. A four-digit PIN means some 10,000 possible passcodes—enough to deter amateur thieves (unless they get lucky), but not sophisticated attackers. To set a harder password, slide the "Simple Passcode" setting to "off." Keep in mind that you'll have to enter any longer passcode every time you want to open your phone, so don't overdo it. A six-character passcode will suffice for most people. Once you've crafted your passcode, tap "Turn Passcode On" and enter your password. You'll be asked to enter it twice to confirm it. Before you show off your super-secure phone, however, consider activating the<a href="http://images.techhive.com/images/article/2013/10/erasedata-100057119-orig.jpg" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="210" src="http://images.techhive.com/images/article/2013/10/erasedata-100057119-small.jpg" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="140"></a> Erase Data setting at the bottom of the Passcode Lock settings screen. Once enabled, your device will erase all data after ten failed passcode attempts—a good safeguard in case your phone ends up in the wrong hands. Android users face a slightly more complex, more traditional encryption procedure. The process is really pretty easy, but the one thing you need is time. Android devices have to go through a lengthy disk-encryption process, just as your PC or external hard drive does. Depending on the size of your device, encryption could take up to an hour or more. During the process, you need to have the device plugged in at all times, and the battery must be charged. Otherwise, the encryption process could fail, and you could lose some or all of your data. Two more things to keep in mind: First, some users report that encryption on Android caused a performance hit on their devices during everyday use. Second, encryption is irreversible—short of a factory reset. All that said, if you want to encrypt an Android phone, here's how I did it on a device running the latest version of Android (4.3 Jelly Bean). <a href="http://images.techhive.com/images/article/2013/10/encrypt-100057120-large.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="233" src="http://images.techhive.com/images/article/2013/10/encrypt-100057120-small.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="140"></a>Android encryption The screen at left shows paragraphs explaining exactly what Android app encryption involves. Once you're okay with that, tap Encrypt phone. If you don't have a PIN or passcode set for your phone, you'll see a warning to set a passcode first. To set a passcode or PIN, go back to Settings > Security and tap Screen lock at the top of the page. From there, choose the option for either a PIN or a password. Android allows PINs to be greater than four digits. After you've set up your PIN or password, go back to the encryption page and tap Encrypt phone again. You'll be asked to enter your PIN, and then you'll be given one last chance to back out. If you're ready to commit, tapEncrypt phone one last time. Now, all you can do is sit back and wait for your phone to encrypt itself. During the process, your phone could reboot several times. Don't touch it until you see the lock screen return. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">Keep malware at bay</h2> Android users are particularly vulnerable to malware. Google, unlike Apple, doesn't vet applications before they go live on Google Play. This has proven an easy way for malware creators to sneak malicious apps onto Google's app store. Malware-laden apps range from those offering free device wallpaper to games, and even to impostors that try to look like popular apps. That's why security vendors such as Avast, Kaspersky, and Lookout offer antivirus and security apps for Android to help keep you secure online. But how good are these <a href="http://www.pcworld.com/article/251345/which_android_security_tools_are_worth_your_time_.html" style="color:rgb(37,167,215)" target="_blank">apps</a>, really? Back in late 2011, results from the AV-Test lab found that the <a href="http://www.infoworld.com/t/android/free-android-antivirus-software-useless-says-testing-firm-178823" style="color:rgb(37,167,215)" target="_blank">free solutions were nearly useless</a>. The firm tested seven of the top free apps at the time and said that the best free solution detected only one-third of any malware present on a device. Even paid solutions weren't doing that great at the time of the 2011 tests, with the top paid apps detecting only around <a href="http://www.pcworld.com/article/243593/for_android_paid_mobile_security_is_better_study.html" style="color:rgb(37,167,215)" target="_blank">50 percent of malicious code</a>. <img alt="" border="0" height="512" src="http://images.techhive.com/images/article/2013/08/lookout_2up-100026082-large-100037660-large-100052251-large.jpg" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580">Lookout's Android security app consistently gets high marks from industry analysts, though it's not the best you can get. "When our report was published in 2011 the AV industry and the threat landscape was in a very early stage on Android," says Hendrik Pilz, director of AV-Test's technical lab. "Only a few malware existed but there were already several apps pretending to be an essential utility on each Android device." (Full disclosure: PCWorld regularly teams up with AV-Test to examine security software for PCs and mobile devices). Nearly two years later, however, the usefulness of many free solutions has improved dramatically. During its most recent look at Android security apps in July, well-known security apps for Android, including those from <a href="http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1%5Breport_no%5D=132728" style="color:rgb(37,167,215)" target="_blank">Avast</a>, <a href="http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1%5Breport_no%5D=132740" style="color:rgb(37,167,215)" target="_blank">F-Secure</a>, <a href="http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1%5Breport_no%5D=132746" style="color:rgb(37,167,215)" target="_blank">Kaspersky</a>, <a href="http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1%5Breport_no%5D=132751" style="color:rgb(37,167,215)" target="_blank">Lookout</a>, and<a href="http://www.av-test.org/no_cache/en/tests/test-reports/?tx_avtestreports_pi1%5Breport_no%5D=132774" style="color:rgb(37,167,215)" target="_blank">TrustGo</a> all earned high marks from AV-Test. The lowest score in that group went to Lookout, which still earned an impressive 98.6 percent detection rating. Besides antivirus and malware scanning, security apps for Android also offer a full <a href="http://images.techhive.com/images/article/2013/10/livesafe-android-2-100057637-large.png" style="color:rgb(37,167,215)" target="_blank"><img alt="McAfee LiveSafe 2014 Android screenshot" border="0" height="249" src="http://images.techhive.com/images/article/2013/10/livesafe-android-2-100057637-small.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="140"></a>McAfee for Android security suite with features such as device location, remote wipe, backup, and suspicious-URL blocking. These extra features usually require a premium subscription, but most apps offer a minimal, basic level of protection for free, including malware scanning. Even if you do pay for the full security experience, there's only so much an app can do. It can't stop a thief from nabbing your device, for example, or prevent a thief from raiding your phone's data if you didn't use a screen lock. However, a security app's backup features can save your data if that data is not automatically backed up to Google. And remote lock and wipe features can prevent a thief from getting in even after your device is stolen. Google also offers remote wipe and lock for free for Android users running a device with Android 2.3 and up, via the <a href="http://www.techhive.com/article/2049308/how-to-use-the-new-android-remote-lock-option.html" style="color:rgb(37,167,215)" target="_blank">Web-based device manager</a>. Security apps for Android may have come a long way in the past couple of years, but they still have room to improve. In March, researchers at Northwestern University and the University of North Carolina showed that they were able to build a piece of malware that Android security apps couldn't detect, <a href="http://www.networkworld.com/news/2013/060613-android-antivirus-270573.html" style="color:rgb(37,167,215)" target="_blank">Network World</a>reported. <h2 dir="ltr" style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">Crossing borders</h2> You might think that the minute you land at JFK from a trip overseas that your rights are immediately protected under the U.S. Constitution, but you'd be wrong. Special rules apply at border crossings into the United States, as well as other countries, that give border agents leeway to interrogate you and search your belongings. That includes confiscating any mobile devices and laptops you might have with you or copying their contents. While these laws are primarily meant to deter terrorism, they've also been used to pull aside activists like Jacob Appelbaum, a computer security researcher and member of the TOR project, and journalists like <a href="http://www.onthemedia.org/story/my-detainment-story-or-how-i-learned-stop-feeling-safe-my-own-country-and-hate-border-patrol/" style="color:rgb(37,167,215)" target="_blank">NPR's Sarah Abdurrahman</a>. Wind up on the wrong list, and you could be, too. You can't do much to prevent yourself from being interrogated, but you can protect your data from being nabbed by an agent and downloaded into some massive data silo in the Utah desert. The <a href="https://www.eff.org/wp/defending-privacy-us-border-guide-travelers-carrying-digital-devices" style="color:rgb(37,167,215)" target="_blank">Electronic Frontier Foundation</a>suggests an interesting option: Leave the hard drive at home and boot your laptop from an SD card. (We've also published full instructions on how to create a Ubuntu boot disk or USB boot drive in our <a href="http://www.pcworld.com/article/2030132/the-ubuntu-guide-for-displaced-windows-users.html" style="color:rgb(37,167,215)" target="_blank">Ubuntu guide</a> for displaced Windows users.) <a href="http://images.techhive.com/images/article/2013/10/dell-xps-13-dev-edition-ubuntu-100057387-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="345" src="http://images.techhive.com/images/article/2013/10/dell-xps-13-dev-edition-ubuntu-100057387-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Using Ubuntu on your laptop while traveling may seem extreme, but it helps to ensure that your private data won't be confiscated while crossing borders. By turning your SD card into a secret Ubuntu boot card, you can leave the country with a "clean" installation of Ubuntu, with no user data on it at all, and your boot drive looks like an innocuous DSLR memory card. Use Ubuntu overseas, connect to your secure cloud accounts for important documents, and simply wipe the SD card of any files before you head home. Even if you don't have any sensitive data to protect, this is such a great, secret-agent-style use for your laptop that you might want to try it simply for the cool factor. But you do have to ensure that your laptop's BIOS cooperates. The easiest way to install an OS onto an SD card is to create a Live CD of Ubuntu Linux, or some variant, such as Mint. Ubuntu is the best choice, because this Linux distribution gives you step-by-step instructions on how to create a live CD. From there, installing Linux is no different from installing Windows: Just pick the drive on which to install Ubuntu (that 32GB or 64GB SD card), then follow the on-screen instructions. Make sure your laptop's BIOS can boot from the SD card reader. We already have a tutorial on <a href="http://www.pcworld.com/article/241032/how_to_enter_your_pcs_bios.html" style="color:rgb(37,167,215)" target="_blank">how to enter your BIOS settings</a>, so in the BIOS utility, look for a category that says "boot order," "boot priority," or something similar. Then make sure your card reader is first in line. <a href="http://images.techhive.com/images/article/2013/10/bios-boot-order-5137405-100057673-orig.jpg" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="434" src="http://images.techhive.com/images/article/2013/10/bios-boot-order-5137405-100057673-large.jpg" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Enter your BIOS and set your flash drive or SD card reader to be your primary boot device. If you stick with the EFF's SD card recommendation, make sure your SD card reader is capable of serving as a boot device. Note that even if your BIOS lets you put the SD reader in your boot order, your peripheral may not be capable of booting the PC. Check with your device manufacturer to confirm this capability. Even if you can't boot from the SD card reader, you can still install Ubuntu onto an SD card and just use an inexpensive SD card-to-USB adapter, many of which look just like USB drives with a slot for the SD card. Once you're up and running, do a few test runs at home with your hard drive removed. The last thing you want to deal with after a red-eye flight to London is a snazzy, secret-agent setup that doesn't work. But if the test runs go without a hitch, you should be all set.

Security to go: Three tips to keep your mobile data safe

Keeping your mobile gear secure while you're zipping across the grid is tricky business. Laptops and tablets—veritable gold mines of per...

7:49 am

Security to go: Three tips to keep your mobile data safe

Security to go: Three tips to keep your mobile data safe

Keeping your mobile gear secure while you're zipping across the grid is tricky business. Laptops and tablets—veritable gold mines of per...

7:49 am

Protect your Facebook account from hackers with two-factor authentication

Nobody likes it when their friends suddenly start spewing links to weight-loss supplements and porn on Facebook. Don't be that person. Using Facebook's two-factor authentication feature can help keep undesireables out of your account—perhaps saving some friendships. Two-factor authentication, for the uninitiated, requires you to enter in another piece of private data in addition to your password in order to log in. This typically takes the form of a single-use security code that gets sent to your smartphone, and it can help keep your account safe in case a hacker or data thief ever gets ahold of your username and password. <img alt="" border="0" height="211" src="http://images.techhive.com/images/article/2013/10/login_approval_setup-100058826-medium.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300">Setting up Facebook's Login Approval feature takes just a couple minutes. To start, visit <a href="https://www.facebook.com/" style="color:rgb(37,167,215)">Facebook.com</a> and log in with your username and password. Next click the gear icon in the upper right corner, and selectAccount Settings from the menu that pops up. On the next screen, selectSecurity from the list on the left, then select Login Approvals. When the Login Approvals section expands, check the box labelled Require a security code to access my account from unknown browsers, and Facebook will walk you through the setup process. By default, Facebook will send security codes through its mobile app, but it can send you text messages as a backup login method. If you don't already have a cellphone number associated with your account, Facebook will ask you to add one. When prompted, select your country from the list, enter your number, then press Continue. Facebook will send you a text message to confirm that your number is indeed yours: Enter the six-digit confirmation code texted to you when prompted, then clickConfirm. <h2 style="font-family:ff-enzo-web,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">Logging in</h2> Facebook will not pester you to enter a security code from a browser it already recognizes, so if you only use Facebook from one computer, you may never be asked to senter a security code. But if you are, here's what to expect: <img alt="" border="0" height="227" src="http://images.techhive.com/images/article/2013/10/enter_code-100058825-large.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="580">After you enter your username and password, you'll be asked to enter a security code. The next time you log into Facebook on a new computer, enter your username and password as usual, then press Log In. On the next screen, Facebook will ask you to enter a security code.<img alt="" border="0" height="221" src="http://images.techhive.com/images/article/2013/10/code_generator-100058827-medium.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300">The Code Generator in Facebook's mobile app. To get that code, open the Facebook app on your phone, tap More (in the toolbar on iOS, swipe left to right to access the More menu on Android), then scroll down and tapCode Generator. Facebook will give you a single-use code that's good for 30 seconds (after 30 seconds, you'll be get a new code). Enter this in on your computer, then press Continue. <h2 style="font-family:ff-enzo-web,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">Limitations</h2> Facebook's two-factor authentication feature won't protect everything, though. It only asks for a security code if you attempt to log in from an unrecognized device, and it only works for login requests from Web browsers—you can log into the Facebook mobile app without having to enter a code. Still, it's better than nothing.

Protect your Facebook account from hackers with two-factor authentication

Nobody likes it when their friends suddenly start spewing links to weight-loss supplements and porn on Facebook. Don't be that person. U...

7:33 am

Protect your Facebook account from hackers with two-factor authentication

Protect your Facebook account from hackers with two-factor authentication

Nobody likes it when their friends suddenly start spewing links to weight-loss supplements and porn on Facebook. Don't be that person. U...

7:33 am

Protect your Google account with two-factor authentication

If you're a heavy Google user, your Google account is kind of a big deal. It's the gatekeeper to your <a href="https://mail.google.com/" style="color:rgb(37,167,215)">email</a>, and your <a href="https://plus.google.com/" style="color:rgb(37,167,215)">Google+</a> account, important<a href="https://drive.google.com/" style="color:rgb(37,167,215)">files</a>, online <a href="http://picasa.google.com/" style="color:rgb(37,167,215)">photo storage</a>...that Google account is your life. With so much at stake, you probably want to keep hackers as far away as possible. Two-factor authentication can help. Two-factor authentication—called 2-step verification in Google's parlance—adds a second step to your Google login. Not only do you have to enter your username and password, but also a single-use security code, which usually gets sent to your phone via an app or text message. In return for the extra effort, you'll get an extra layer of protection that can help keep hackers out of your persona data. <h2 style="font-family:ff-enzo-web,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">Setting up 2-step verification</h2> If you have an account for any of Google's services (Gmail, Google+, and so on), the setting up 2-step verification fairly straightforward. Start by visiting <a href="http://www.google.com/" style="color:rgb(37,167,215)">Google.com</a>, and press the blue Sign In button in the upper right hand corner, and log in. Once signed in, look for your profile picture in the upper right corner and click it, then select Account from the menu that appears. (If you didn't set a photo to go with your account, you'll see a generic sillouette in its place). <img alt="" border="0" height="142" src="http://images.techhive.com/images/article/2013/10/2step_verification-100065992-large.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="580">Click the Edit link to get started. Once you're at the Accounts settings page, select Security from the list along the left. Click the Edit link next to the 2-step verification heading to begin the process of setting it up. Google will give you a brief pictoral overview of what to expect: Give it a once-over, then press Start setupwhen you're ready to rock. On the next screen, Google will ask you for your cellphone number. Select your country from the drop-down list (as represented by the flag icon), enter your number as instructed, then choose how you want to receive your security codes. You can get security codes either via text message or voice call: If you're hearing impaired or aren't great at remembering strings of numbers, you'd probably be better off going with the Text message option. On the other hand, the Voice Call option might be a better choice if you have a limited—or no—text message plan. <img alt="" border="0" height="325" src="http://images.techhive.com/images/article/2013/10/where_to_send_codes-100065990-large.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="580">Enter your phone number then choose how you want to receive security codes. Once you've entered your number and chosen how you want to recieve security codes, press Send code, and Google will send a test code to your phone. On the next screen, enter this test code where instructed, then press the Verify button. You're almost done! Google will ask you if you want to trust the computer you're logged in on: If you "trust" a computer, you don't need to use a security code on it. This might be useful if you lose your phone and need to get into your Google account, or you're sick of entering security codes on your locked-down, highly secure office computer. Make your choice and press Next; you can go back and change this setting later if you change your mind. Finally, Google will have you confirm one last time that you want to use 2-step verification. Press Confirm, and you're all set to go. <h2 style="font-family:ff-enzo-web,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">There's always a catch...</h2><img alt="" border="0" height="173" src="http://images.techhive.com/images/article/2013/10/reconnect_your_apps-100065993-medium.png" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="300"> There is a catch: If you use any of Google's services through Apple's Mail, Calendar, or Contacts apps on iOS or OS X—or through the Mail app on BlackBerry or Windows Phone—you will need to "reconnect" your apps and devices to your Google account. This will let you generate special app-specific passwords so you can still log into your Google accounts through other apps. How you reconnect your apps varies some depending on the apps you use, so we won't get into too much detail here, but when prompted, press Reconnect my apps, and Google will step you through the process.

Protect your Google account with two-factor authentication

If you're a heavy Google user, your Google account is kind of a big deal. It's the gatekeeper to your email , and your Google+ ac...

7:27 am

Protect your Google account with two-factor authentication

Protect your Google account with two-factor authentication

If you're a heavy Google user, your Google account is kind of a big deal. It's the gatekeeper to your email , and your Google+ ac...

7:27 am

Extend your Wi-Fi network throughout the house

The wireless signal from Aidan's router doesn't reach throughout the house. Here are a few ways to fix the problem. Extending a Wi-Fi network can be as easy as playing with cardboard and tape, or as difficult as rewiring your house. It all depends how big a boost you need, and how much time and money you're willing to devote to the task. Here are three ways to increase your signal's range.<h3 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)"> Boosters</h3>You know those little antennas that screw onto your router? You can improve the signal by replacing them with bigger antennas, or more directional ones. <a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/10/1024-booster-homemade-100057621-orig.jpg" style="color:rgb(37,167,215)"><img alt="" border="0" height="88" src="http://images.techhive.com/images/article/2013/10/1024-booster-homemade-100057621-small.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="140"></a> You can also improve the existing antenna, making it directional. All you need is a few minutes and some common household materials. See <a href="http://www.pcworld.com/article/150951/router_reflector_hack.html" style="color:rgb(37,167,215)">Extend Your Wi-Fi Range With a Parabolic Reflector</a>for detailed instructions. <a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/10/1024-booster-generic-100057619-orig.jpg" style="color:rgb(37,167,215)"><img alt="" border="0" height="140" src="http://images.techhive.com/images/article/2013/10/1024-booster-generic-100057619-small.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="140"></a> If you're not the do-it-yourself type, or if you need to boost the signal in all directions, you can buy a generic antenna for a few dollars. I've seen this same antenna (see image to the right) sold under different brand names--priced from $2 to $7. And yes, I've tried it and it helps…a bit. For a more powerful boost than either of those, try the directional <a href="http://www.tp-link.com/en/products/details/?model=TL-ANT2409A" style="color:rgb(37,167,215)">TP-Link TL-ANT2409A</a>. You can get it for $25 if you shop around. <h3 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">Extenders</h3><a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/10/1024-amped-wireless-rec10-100057631-orig.jpg" style="color:rgb(37,167,215)"><img alt="" border="0" height="225" src="http://images.techhive.com/images/article/2013/10/1024-amped-wireless-rec10-100057631-small.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="140"></a> You plug one of these devices, also called repeaters, into a wall socket as far from the router as you can get and still receive a good signal. The extender picks up the signal and rebroadcasts it. In general, I find these more effective than boosters. But they're also more expensive, and are trickier to set up, since you have to find the best location and connect them to the network. The best one I've tested (and I haven't tested all that many) was the <a href="http://www.ampedwireless.com/products/rec10.html" style="color:rgb(37,167,215)">Amped Wireless REC10</a>. If you look around, you can buy one for $70.In general, I find these more effective than boosters. But they're also more expensive, and are trickier to set up, since you have to find the best location and connect them to the network. <h3 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">HomePlug</h3> I used to be a fan of this technology, which carries network data over your house's electric wiring. The adapters are basically power bricks with Ethernet ports. Some also have Wi-Fi Antennas.<a class="zoom cboxElement" href="http://images.techhive.com/images/article/2013/10/1024-homeplug-100057635-orig.jpg" style="color:rgb(37,167,215)"><img alt="" border="0" height="140" src="http://images.techhive.com/images/article/2013/10/1024-homeplug-100057635-small.jpg" style="box-sizing: border-box; border-width: 0px; vertical-align: middle; width: auto; height: auto; max-width: 100%; float: left;" width="140"></a> You won't have much trouble adding HomePlug to your network--you just plug it in and it works…if it works. All sorts of things can interfere with HomePlug signals--wiring, the location of the washing machine, the type of light bulbs you use. I used HomePlug happily for years. It didn't give me Ethernet speed or even 802.11n speed, but it was faster than my Internet connection and that was all that I needed. Then it just stopped working. I never figured out way.

Extend your Wi-Fi network throughout the house

The wireless signal from Aidan's router doesn't reach throughout the house. Here are a few ways to fix the problem. Extending a Wi...

7:24 am

Extend your Wi-Fi network throughout the house

Extend your Wi-Fi network throughout the house

The wireless signal from Aidan's router doesn't reach throughout the house. Here are a few ways to fix the problem. Extending a Wi...

7:24 am

When malware strikes: How to clean an infected PC

You work hard to protect your PC from the malicious thugs of our digital world. You keep your antivirus program up to date. You avoid questionable Web sites. You don't open suspicious email attachments. You keep Java, Flash, and Adobe Reader up-to-date—or better yet, you <a href="http://www.pcworld.com/article/2030153/how-i-ditched-the-security-risks-and-lived-without-java-reader-and-flash.html" style="color:rgb(37,167,215)" target="_blank">learn to live without them</a>. But against all odds, a clever new Trojan horse slipped through the cracks, and now you're the unhappy owner of an infected PC. Or perhaps a less-vigilant friend has begged you to clean up a plague-ridden mess. Obviously, you need to scan the computer and remove the malware. Here's a methodical approach that you can use to determine what the problem is, how to scan, and what to do afterward to protect the PC from future invasions. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">1. Verify the infection</h2> Is the PC in question really infected? I've seen people blame "another damn virus" for everything from a bad sound card to their own stupidity. The first step in restoring the system's health is to determine whether what you're dealing with is a virus rather than a problem with hardware, software, or user error. If your PC is unusually slow, or if it seems to do a lot of things on its own that you haven't asked it to do, you have reason to be suspicious. But before you decide that a virus must be responsible, take a moment to launch the Windows Task Manager (right-click the Windows taskbar, and select Task Manager from the pop-up menu). Open the Processes tab, and check for any strange or unknown applications running in the background—especially those with nonsensical names and no recognizable authority listed in the description. The odd-looking "wuauclt" process is fine, for example, because it belongs to Microsoft (it's actually part of the Windows Update service, as you can tell from the description.) Of course, this is only general guidance; there's nothing to stop a piece of malware from masquerading as a legitimate process by sporting an inoffensive description. That said, you'd be surprised how often a piece of malware gives itself away with a line of strange characters or symbols where the process description should be. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">2. Check for sure signs of malware</h2> Truly insidious malware will preemptively block you from trying to remove it. If your PC suddenly won't load utilities that might help you manually remove malware—such as msconfig or regedit—be suspicious. If your antivirus program suddenly stops loading, that's a huge red flag. <a href="http://images.techhive.com/images/article/2013/05/rogue_malware1-100039329-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="426" src="http://images.techhive.com/images/article/2013/05/rogue_malware1-100039329-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a><small style="font-size:9px;text-align:center;text-transform:uppercase;display:block;float:left;background-image:url(http://csmb.staticworld.net/images/furniture/techhive/backgroundwhite70.png);color:rgb(51,51,51);padding:1px 3px 2px;background-repeat:initial initial">AVGFake warnings like this one try to scare you into running a file to 'remove malware' (read: install malware) or giving up your credit card information to pay for bogus antivirus software. Sometimes the attack is more obvious. If a program you don't recognize suddenly pops up and starts displaying dire warnings and asks you to run an executable file or asks for your credit card number, your PC isdefinitely infected with some nasty malware. Never fork over your credit card information or other personal data to a program or website that tries to warn you that your PC is about to die. More often than not it's a <a href="http://www.pcworld.com/article/239272/rogues.html" style="color:rgb(37,167,215)" target="_blank">rogue program</a>, fear-mongering malware that tries to scare you into giving up your private info by issuing doomsday warnings of imminent hard drive failure, catastrophic viral infection, or worse. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">3. Check online for possible fixes</h2> The one benefit of those scary pop-ups is that they could point you toward a cure. Use your favorite search engine to look for phrases that appear in the pop-up—you'll probably find other people fighting the same infection. Their experiences could help you identify your enemy or even find step-by-step instructions for removing the malware. Be prudent: Take advice only from sites that seem reputable, and remember to perform a full scan of your PC after you've followed any instructions, even ours. Barring any clues that lead you to a magic solution, scanning becomes your next and most important step. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">4. Assume that your old virus scanner is compromised</h2> Don't waste time scanning your hard drive(s) with your regular antivirus program. After all, that program probably failed to catch the malware in the first place. But don't be too hard on it. Nothing's perfect, and even the best antivirus program can occasionally miss a new or particularly cleverly designed virus. And once that virus slips through, your antivirus program is compromised. You have to assume that the malware, not the security software, is in control. You need a fresh malware scanner—one that's not already installed on your computer. It must be capable of detecting and removing malware from your PC, and you need to run it in an environment where the malware can't load first. Linux is your best bet, but before you jump to that option, try booting into Windows Safe Mode to see if you can outflank your virus infestation there. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">5. Use a lightweight scanner inside Safe Mode</h2> Windows has a Safe Mode that boots a minimal version of the operating system, with generic drivers and nothing else. It doesn't load most startup applications and—most likely—it won't load the malware that's infesting your PC. To enter Safe Mode, boot your computer and press the F8 function key before Windows starts loading. The timing is tricky, so it's best to mash F8 repeatedly from the moment the motherboard manufacturer's logo appears onscreen until you get the boot menu. <a href="http://images.techhive.com/images/article/2013/05/entering-safe-mode-100039271-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/entering-safe-mode-100039271-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Use the Windows boot menu to access Safe Mode. When you reach that menu, select Safe Mode with Networking from the list of boot options. The with Networking part is important—you're going to need Internet access to solve your virus problem. Once in Safe Mode, open Internet Explorer (using other browsers in Safe Mode is often problematic) and run a reputable online virus scanner such as<a href="http://www.bitdefender.com/scanner/online/free.html" style="color:rgb(37,167,215)" target="_blank">Bitdefender</a>. For best results I recommend using the <a href="http://www.eset.com/us/online-scanner/" style="color:rgb(37,167,215)" target="_blank">ESET Online Scanner</a>, a Web-based virus detection app that is always up-to-date and runs off a remote server. You'll have to accept a browser add-in, but the scanner should remove it when it's done. Before you start the scan, clickAdvanced settings and enable as many extra levels of scrutiny as you can, including scanning file archives and browser data. <a href="http://images.techhive.com/images/article/2013/05/eset-3-100039274-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="529" src="http://images.techhive.com/images/article/2013/05/eset-3-100039274-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>The ESET Online Scanner runs in your browser and does a thorough job of rooting out malware from your PC. You might also try Trend Micro's<a href="http://housecall.trendmicro.com/us/" style="color:rgb(37,167,215)" target="_blank">HouseCall</a>. Though it isn't a Web app, it is portable, so you can download HouseCall on another computer and copy it to a flash drive, thereby creating a portable PC virus scanner. Then, when you run into trouble you can plug the flash drive into the infected PC and run the program from there (you'll still need an Internet connection for a definition update, however.) When using HouseCall, don't run it on default settings: Before you click the big blueScan Now button, click Settings and select Full system scan. <a href="http://images.techhive.com/images/article/2013/05/housecall-1-100039277-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="460" src="http://images.techhive.com/images/article/2013/05/housecall-1-100039277-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Trend Micro's HouseCall utility is another excellent, free virus scanner and malware removal tool. Whichever scanner you use, don't rush to get through this part of the process. Check the options and select the slowest, most thorough scan. Then, once the scan has started, step away from the PC. Read a book. Do the dishes. Spend time with someone you love. The scan will—and should—take hours. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">6. Remember: The second scan's the charm</h2> When that first scan is done—just to be sure—run another one with a different scanner. It's easy, and you'll sleep better after multiple scanners have assured you that your drive is clean.<h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)"> 7. Look to Linux as your last line of defense</h2>Booting into Safe Mode may not short-circuit particularly malicious malware. If you still have trouble with an infection after running multiple scans in Safe Mode, you'll have to bypass Windows altogether and avoid booting from the hard drive. To manage that trick, use a bootable CD or flash drive running a Linux-based antivirus utility. You don't have to know Linux to take this step. But you will want an Internet connection, since these scanners must go online to update their malware databases. The first step is to download a bootable virus scanner as an .iso file. From it, you can easily create a bootable CD. In Windows 7, double-click the file and follow the prompts. In Windows 8, right-click the file and select Burn disc image. For earlier versions of Windows, you'll need a third-party program such as the free <a href="http://isorecorder.alexfeinman.com/W7.htm" style="color:rgb(37,167,215)" target="_blank">ISO Recorder</a>. With its Windows-like user interface, the <a href="https://support.kaspersky.com/viruses/rescuedisk" style="color:rgb(37,167,215)" target="_blank">Kaspersky Rescue Disk</a> will make you feel at home. But you have to be careful in setting up the scan. First, the Kaspersky Rescue Disk doesn't update its malware dictionary automatically. To do this manually, select the Update Center tab and click Start update. Once the utility is updated, return to theObjects Scan tab, click Settings, and set the security level to the highest position. Make sure that all of your hard drives are checked before you start the scan and leave the room. <a href="http://images.techhive.com/images/article/2013/05/kaspersky-1-100039281-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/kaspersky-1-100039281-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>When you boot your PC with the Kaspersky Rescue Disk utility, you'll find yourself in a custom Linux environment. Simply update the Rescue Disk, crank all the scan settings up to maximum power, and let 'er rip. If you want to boot the Kaspersky Rescue Disk from a flash drive, you'll need to download the prosaically named <a href="http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/rescue2usb.exe" style="color:rgb(37,167,215)" target="_blank">Utility to record Kaspersky Rescue Disk 10 to USB devices</a>. Save it in the same folder as the .iso file, run the utility, and follow the wizard. The <a href="http://www.f-secure.com/de/web/labs_global/removal-tools/-/carousel/view/142" style="color:rgb(37,167,215)" target="_blank">F-Secure Rescue CD</a> isn't as outwardly friendly as Kaspersky's program. In fact, it may make you nostalgic for DOS. But it works, though you may receive the following (unduly alarming) warning message: If a Windows system file is infected, the computer may not restart. I've never heard of anyone whose Windows system failed to restart after an F-Secure scan, and I suspect that the eventuality is very rare. I also suspect that if malware did infect a Windows system file—and if F-Secure couldn't clean the file without destroying it—reinstallation might be your only option anyway. <a href="http://images.techhive.com/images/article/2013/05/f-secure-1-100039275-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/f-secure-1-100039275-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>The F-Secure Rescue CD is a bare-bones cleaning utility for when you need to wipe every piece of malware from your PC without starting Windows. F-Secure has a stripped down, unattractive, text-based user interface. But unlike Kaspersky, it updates its definitions automatically (if it can find an Internet connection), and starts a full, thorough scan with no fuss—you have to do little more than agree to the EULA. F-Secure doesn't offer a special USB utility. If you want to move a copy of it onto a flash drive, you'll have to download and run the <a href="http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/" style="color:rgb(37,167,215)" target="_blank">Universal USB Installer</a>. In Step 1, you'll find F-Secure Rescue CD near the bottom of a very long list. I suggest you go straight to the bottom, and then look for it while slowly scrolling up. <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">8. Protect your newly disinfected PC</h2> When you're satisfied that your drive is clean, try rebooting into good old Windows. Then uninstall your old antivirus program—it has been compromised. Of course, you don't want to stay unprotected. Reinstall the program and update to the latest version, or (if you've lost all faith in it) install a competitor. For more information on how to choose the best antivirus program for your needs, check out our full rundown—with empirical testing—of the <a href="http://www.pcworld.com/article/2025949/security-software-showdown-9-antivirus-suites-empirically-tested.html" style="color:rgb(37,167,215)" target="_blank">best security software</a> available today. Because when it comes to malware, a byte of prevention is worth a terabyte of cure.

When malware strikes: How to clean an infected PC

You work hard to protect your PC from the malicious thugs of our digital world. You keep your antivirus program up to date. You avoid questi...

11:38 am

DIGITAL SANKALP

security, hackers Listen up: RSA keys snatched by recording CPU sounds with a phone

security, hackers Listen up: RSA keys snatched by recording CPU sounds with a phone

Force YouTube to buffer your entire video

Force YouTube to buffer your entire video

Security to go: Three tips to keep your mobile data safe

Security to go: Three tips to keep your mobile data safe

Protect your Facebook account from hackers with two-factor authentication

Protect your Facebook account from hackers with two-factor authentication

Protect your Google account with two-factor authentication

Protect your Google account with two-factor authentication

Extend your Wi-Fi network throughout the house

Extend your Wi-Fi network throughout the house

When malware strikes: How to clean an infected PC

Popular Posts

Comments

Blog Archive

Blog Archive